Top Risks

• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and third-party sharing (→ Privacy +10.0).
• Developer uses free Gmail address with no business domain; brand_mention flags Google impersonation.
• No CSP declared (MV3 mitigates but no explicit policy); install_url_hijack opens internal whatsnew.html on install.
• last_updated unknown — cannot rule out abandonment; maintenance scored conservatively at 6-month band.
• Extension contacts 4 external search-engine hosts with no host_permissions declared; network surface matches function but increases reach.

Evidence

• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's global policy, scope_extension=false, data_collection=true, third_party_sharing=true → Privacy D rule → +10.0.
• brand_impersonation store brand_mention.is_impersonation=true, brands_mentioned=[google], confirmed_owner=false, developer_domain=gmail.com.
• free_webmail_developer manifest developer_email=steven2358@gmail.com; no developer_name; no business domain.
• install_url_hijack crx install_url_hijack=true, target=whatsnew.html (internal). Lower severity than 3rd-party target but still flagged.
• last_updated_missing store last_updated empty and months_since_update null; cannot confirm active maintenance — scored at 6-month stale band (+3.5).
• js_external_hosts crx Contacts lens.google.com, www.bing.com, www.tineye.com, yandex.com — 4 domains, matches stated function (reverse image search).
• verified_publisher store verified_publisher=true AND is_featured_by_google=true; discounts applied but capped per v3.5 invariant 0c (no resolving dev domain).
• cve_findings_empty crx cve_findings_raw=[] and code_findings_raw=[]; no library CVEs or malicious code patterns detected.

Permissions Breakdown

• contextMenus low Adds right-click menu items; low standalone risk.
• storage low Local preference storage only; no exfil capability alone.

Pillar Scores

Bookkeeping